Contact form · GDPR

GDPR-Friendly Contact Form: Required Fields, Notice, Retention

A contact form processes personal data. Five points keep it clean – without forced checkboxes or legalese.

Measure first, then fix. The free check shows in seconds what your site sends to Google, Meta and co. before any consent. The Fix Kit (€19) shows the fix for every finding – local Google Fonts, click-to-load for YouTube and Maps, tracking after consent, security headers.

Check your website for free Get the Fix Kit Network report (€39)

Five points

Only necessary required fields: email and message.
Notice at submission with a link to the privacy policy.
HTTPS on the whole site.
Spam protection without Google: honeypot field.
Retention: delete enquiries once handled and no retention duty applies.

Honeypot

<div aria-hidden="true" style="position:absolute;left:-9999px">
  <label for="website">Leave empty</label>
  <input id="website" name="website" tabindex="-1" autocomplete="off">
</div>
<!-- server side: if "website" is filled, discard the request -->

FAQ

Do I need an “I agree to the privacy policy” checkbox?

For an enquiry you are asked to answer, consent is usually not the legal basis – processing serves to answer the request. A clear notice with a link to the privacy policy next to the submit button is common and sensible.

May I use Google reCAPTCHA?

reCAPTCHA transmits data to Google and should be named in the privacy policy and ideally loaded only when the form is used. Alternatives without third parties are a hidden honeypot field or a simple question.

Check your website for free Get the Fix Kit Network report (€39)